Australia, New Zealand invest AUD $7 million in cyber education

Australia and New Zealand have ranked third globally for phishing vulnerability, with a baseline Phish-prone Percentage (PPP) of 36.8% according to KnowBe4's 2025 Phishing by Industry Benchmarking Report.

The report provides an analysis of cybersecurity readiness based on how likely employees are to fall victim to social engineering or phishing attempts. The PPP metric, developed by KnowBe4, reflects the percentage of users who are susceptible to phishing prior to any security training. For Australia and New Zealand (ANZ), this baseline figure of 36.8% is higher than both the global average of 33.1% and the European average of 32.5%.

KnowBe4's study draws on data from 67.7 million simulated phishing exercises conducted among 14.5 million users in 62,400 organisations worldwide. Employees underwent a programme of security awareness training, with their PPP tracked at intervals of ninety days and again after more than a year, to evaluate the effectiveness of ongoing training in reducing cyber risk.

The findings highlight a marked improvement in resilience to phishing threats following sustained training. Within the first ninety days of awareness training, the average PPP in the region dropped from 36.8% to 19.9%. After twelve months, this figure declined further to just 4.9% on average. KnowBe4 noted that these results are consistent with global patterns, where ongoing security awareness initiatives play a substantial role in strengthening defences against cyber attacks.

Large organisations in Australia and New Zealand were identified as the most susceptible globally, with an initial PPP of 44.6%. The report shows these organisations reduced their risk dramatically to 4.7% after a year of continuous security awareness training. The data also indicated that the critical infrastructure and banking sectors were the most vulnerable to phishing in the ANZ region at the outset of the study.

Government action in response to the findings has included an investment of AUD $7 million, distributed among 200 recipients, to support community-level cyber education initiatives. This forms part of broader efforts to build long-term resilience, which also include legislative measures to address the increasing sophistication of cyber threats targeted at critical infrastructure sectors.

International cooperation has become a core strategy in the region's response to cyber challenges. Australia and New Zealand have engaged with partners through the Five Eyes security alliance and invested in developing a skilled cybersecurity workforce as part of their approach to strengthening organisational and national resilience.

Erich Kron, Security Awareness Advocate at KnowBe4, commented on the results: "Our report shows that large ANZ organisations began with the highest phishing vulnerability globally at 44.6% yet achieved a remarkable reduction to just 4.7% after ongoing training. The most significant shift we are seeing is the growing recognition by the Australian government of the critical role that community-level education plays in building a resilient cyber ecosystem, evidenced by their AUD $7 million investment across 200 recipients. While progress is being made, it is clear from the data in the report that sustained security training is essential to drive long-lasting change."

The KnowBe4 report reiterates the importance of regular, comprehensive security training in reducing individuals' susceptibility to phishing and social engineering, particularly within sectors deemed high risk. The report underlines the necessity of a multifaceted approach that combines education, government policy, industry collaboration, and workforce development to address the persistent risk posed by phishing attacks in the region.